Transparent pricing.
Governed AI workforce.
Pick the plan that fits your investigation volume. Every plan includes the full Helix governance backbone — kill-switch, audit log, and HITL escalation — regardless of tier.
Security Alert Triage platform
Autonomous triage of your security alert queue. Priced by investigation volume — pay for what Helix triages, not for seats.
Sentinel Starter
For growing security teams that need governed triage at a predictable price.
- Up to 500 investigations per month
- $5 per investigation overage
- Microsoft Defender connector
- 1 connector source
- L1 autonomy (analyze-only)
- Email escalation
- 90-day audit log retention
- Standard support (next business day)
Sentinel Pro
For mature security programs that need multi-connector coverage and gated remediation.
- Up to 2,000 investigations per month
- $5 per investigation overage
- All 8 connector sources
- L1 and L2 autonomy (gated remediation)
- PSA / ticketing integration
- HITL approval queue
- 1-year audit log retention
- Priority support (4-hour SLA)
- Quarterly posture review
Sentinel Enterprise
Unlimited investigations, dedicated SLA, and custom playbook authoring for large teams.
- Unlimited investigations
- All 8 connector sources
- L1, L2, and L3 autonomy
- Custom playbook authoring
- Dedicated Customer Success Manager
- Unlimited audit log retention
- 1-hour SLA, 24/7 support
- On-site security posture workshop
- Custom SIEM / SOAR integration
Sentinel plan features
| Feature | Starter | Pro | Enterprise |
|---|---|---|---|
| Investigations per month | 500 | 2,000 | Unlimited |
| Overage cost | $5/each | $5/each | Negotiated |
| Connector sources | 1 | 8 | 8 + custom |
| Autonomy levels | L1 only | L1, L2 | L1, L2, L3 |
| HITL approval queue | |||
| PSA / ticketing integration | |||
| Audit log retention | 90 days | 1 year | Unlimited |
| Custom playbooks | |||
| Dedicated CSM | |||
| Support SLA | Next day | 4 hours | 1 hour, 24/7 |
AI role SKUs
Add individual AI roles to your existing security stack, or buy the Complete bundle for all current and future Helix roles.
Analyst
A single AI analyst role. Best for teams that need triage coverage without full-platform licensing.
- Security Alert Triage
Responder
Adds gated remediation and HITL approval to the Analyst role.
- Security Alert Triage
- Gated Remediation
Suite
Five AI roles covering the full SOC analyst workflow — triage, response, posture, and reporting.
- Security Alert Triage
- Gated Remediation
- Posture Monitor
- Incident Summarizer
- Weekly Posture Report
Complete
All current and future Helix AI roles, unlimited seats. The full governed AI workforce.
- All current Helix roles
- All future Helix roles (included as shipped)
- Unlimited seats
- Custom role authoring
Workforce SKUs can be used standalone or combined with a Sentinel plan. Contact sales for bundle discounts.
Frequently asked questions
- What counts as an investigation?
- An investigation is one alert processed end-to-end by the Helix triage playbook — ingest, classify, filter, enrich, and either resolve (false positive) or escalate (true positive / unknown). Suppressed duplicates within a 5-minute window count as one investigation.
- Can I change plans mid-month?
- Yes. Upgrades take effect immediately and are prorated. Downgrades take effect at the next billing cycle.
- What connectors are supported?
- Helix Sentinel Pro and Enterprise support all 8 connectors: Microsoft Defender (M365), SentinelOne, NinjaOne RMM, Adlumin MDR, Trustifi Email Security, Atera RMM, BlackPoint MDR, and Google Workspace. Starter supports one connector.
- Is there a free trial?
- Yes — book a 30-minute working session and we will run Helix against a redacted sample of your real alerts at no charge. You get a written posture report regardless of whether you buy.
- How is billing handled?
- Helix uses Stripe for billing. You are charged monthly in advance. Overage investigations are billed at the end of each billing cycle. Enterprise customers are invoiced on a negotiated schedule.
- Is Helix EU AI Act Article 14 compliant?
- Helix is designed to map to the five oversight abilities in Article 14 of Regulation (EU) 2024/1689. Human escalation is mandatory for all high and critical findings regardless of autonomy level. A written posture summary is available on all plans.
Not sure which plan? We will help you size it.
Book a 30-minute working session. We run Helix against a redacted sample of your real alerts and recommend the plan that fits your actual investigation volume — no pressure, no slide deck.
Book a demo